Data flow diagram construction and anomaly monitoring method based on server data acquisition and analysis

Through eBPF kernel probe and dynamic flow graph modeling, combined with LZ4 compression and multi-dimensional anomaly detection, the static configuration dependence and insufficient abnormal detection accuracy in data flow graph construction are solved, and low-latency and high-accuracy data flow monitoring is achieved, reducing the false alarm rate and false interception rate.

CN120512286APending Publication Date: 2025-08-19COLORFUL GUIZHOU IMPRESSION NETWORK MEDIA CO LTD
4 Cites 0 Cited by

Patent Information

Application Number
CN202510733541.3
Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
Filing Date
2025-06-03
Publication Date
2025-08-19

AI Technical Summary

Technical Problem

In the construction of data flow graphs, the problems of static configuration dependence, scanning performance loss, insufficient abnormal detection accuracy and missing topological associations in the data flow graph, resulting in high path error rate, high error interception rate, high detection delay and false alarm rate.

Method used

The eBPF kernel probe is used to capture the seven-tuple metadata of the TCP/UDP layer, combined with LZ4 compression and ring buffer, dynamic flow graph modeling, and two-factor weighting model and multi-dimensional anomaly detection to achieve automated blocking through the OpenFlow protocol.

Benefits of technology

It has achieved low latency and high accuracy data flow graph construction, low CPU occupancy rate, reduced false alarm rate, reduced legal traffic error interception rate, and increased detection accuracy to 97.2%.

✦ Generated by Eureka AI based on patent content.
Patent Text Reader

Abstract

The invention belongs to the field of server data acquisition and analysis, and particularly relates to a data flow diagram construction and anomaly monitoring method based on server data acquisition and analysis, which comprises the following steps: (1) non-intrusive data acquisition: 1) an eBPF kernel probe captures seven-tuple metadata (source / target IP, port, protocol and the like) of a TCP / UDP (Transmission Control Protocol / User Datagram Protocol) layer; 2) LZ4 compression (the compression ratio is greater than or equal to 70%) and annular buffer area packet loss prevention (the packet loss rate is lt; 0.01% of a standby thread is switched; (2) modeling a dynamic flow diagram; the method has the technical effects that 1) the data flow diagram is constructed to delay lt; 300ms (actually measured mean value); 2) the detection accuracy rate is 97.2% (CICIDS2017 data set covers 6 types of attacks); 3) CPU occupancy rate lt; 3%, and the false alarm rate is reduced to 9.3%.
Need to check novelty before this filing date? Find Prior Art